Service Graph Connector for Microsoft Defender Endpoint – CMDB Data Quality Concerns

[RBfleming]

We installed the Service Graph Connector for Microsoft Defender Endpoint with the expectation that Microsoft Defender discovery data would be used to populate and enrich our CMDB.

After implementation, however, we found that thousands of records were being created in the Computer table with very limited information. In some cases, if only an IP address or MAC address was identified, a Computer CI was still created.

We initially contacted Microsoft to better understand the behavior and identified three critical concerns. During those discussions, Microsoft clarified that the connector and its implementation are owned by ServiceNow rather than Microsoft.

We then contacted ServiceNow and were informed that the out-of-box integration does not include a default mechanism for managing devices that have not been onboarded into Defender. Instead of placing these records into a staging or "unknown device" area where customers can evaluate them and apply qualification rules, the integration can result in records being created directly in the Computer table.

Has anyone else implemented this connector and encountered similar CMDB data-quality concerns? If so, how are you addressing them?

We would like to utilize the connector to support our Security team, but we also need to ensure that doing so does not negatively impact the integrity and quality of the CMDB based on the current OOB implementation.

Any lessons learned, configuration approaches, or has anyone else contacted ServiceNow about this plugin? According to Microsoft, several customers have discussed this with them so curious if anyone came up with a possible solution that they are willing to share or discuss.

Thanks in advance.

[ninakovache]

Hello RBfleming,

We are also testing this integration and have observed a similar issue. A significant number of computer CIs are being created with empty device names, and some of the imported records do not appear to be available in Microsoft Defender.

If I have any updates, I will post here.

Please update also if you have any resolution.

Thanks.

[Chris150]

Looks like you have to update the integration to only bring in devices that have been onboarded.

[ninakovache]

Hello Cris150,

Do you mean the plugin for the integration or anything else, as I am on the latest version?

Just got reponse from ServiceNow that such filter is not available with the SG Connector for MS Defender Endpoint.

[Chris150]

I meant the actual components of the integration.  Ive been looking through the forums and other internet sources and everyone has the same problem.  ServiceNow did not include a low/no code way to exclude certain devices.

When I connected Defender to our dev instance, it brought in everything from defender.  Including 3 Nintendo 3Ds. 🤣

ServiceNow needs to update this SG to allow for a filter that can exclude devices that have not been onboarded in Defender.